Reports of unauthorized access, data leaks, and ransomware that stops operations keep coming. This is not only a large-company story. Small and mid-sized firms with membership sites, booking systems, ecommerce, or internal cloud tools are hit through the same paths.
Many teams still say they do not know where to start. Before buying expensive products, there are basics that work across sizes.
IPA (Information-technology Promotion Agency, Japan) publishes “Six Rules for Information Security” and a five-minute self-check for SMEs. Guideline version 4.0 (March 2026) added backup to the six rules, and the self-check now covers safer website operations and cutting unnecessary inbound traffic.
This article restates those six rules in workplace language, then lists what to check first on public web apps and admin screens. Penzo is back on the eyecatch after a while, as a soft guide into the checklist.
Why review the basics now
Entry points are not only rare zero-days. Unpatched OS and software, reused passwords, admin panels open to the internet, and servers without backups are common “we know, but later” items.
IPA alerts also keep asking for inventories of public apps, external services, and held data. Supply-chain incidents are rising, and partners ask about your controls more often.
Closing open holes beats waiting for perfection. The six rules are that first list.
The six rules in plain language
In development and operations terms:
- Keep OS, software, and runtimes such as PHP on safe current builds
- Use antivirus and keep definitions current
- Use long, complex, unique passwords, and MFA where you can
- Review sharing so outsiders cannot open what they should not
- Take backups and confirm you can restore
- Learn current attack patterns and share them inside the company
Backup was spelled out in version 4.0 because ransomware that stops business has become common. Having a copy is not enough; you need a restore that works.
The 25-item self-check covers basics, employee habits, and organization. You do not need to finish every item at once. Start with the six rules and whatever the check marks as missing.
What to check first on web systems
If you run a public site or business system, add these early:
- Admin panel exposure (is it open to the whole internet?)
- Admin and vendor accounts, plus MFA
- App and server versions (PHP, Node, middleware)
- Where API keys live, and least privilege
- What logs you keep, and who can spot anomalies
- Whether you hold more personal or customer data than you need
Admin panels are easy targets: if login works, everything may be visible. VPN, IP allowlists, and MFA cut risk quickly.
When an emergency fix ships for a language or framework, check the running version before changing app code. Files alone can leave old workers running, so include a restart.
Leftover vendor or cloud accounts are common. Without a list of who owns which contract, odd accounts stay hidden. A simple roster is enough to start.
Common pitfalls
A weak admin panel left after a rushed feature. Dev default passwords still on production. Logs kept too short to notice intrusion. Data piles up with no owner map.
“Buying a security product means we are safe” is a frequent misunderstanding. Products help, but weak updates, permissions, backups, and sharing still leave holes.
When AI builds screens quickly, do not postpone exposure and auth. Speed is valuable; it does not close an open door.
A practical order
You do not need policies and audits on day one. A realistic order is:
- Use the six rules and self-check to list gaps
- Close public-face holes (admin, membership, APIs) first
- Confirm backup and a restore test
- List vendor and cloud accounts and permissions
- Share a short basic policy with the team
Leaders should not leave this only to IT. IPA’s part 1 stresses leadership and accountability. When the floor says they cannot stop delivery, priority has to come from management.
Summary
Security does not have to start with a special product. Learn gaps with IPA’s six rules and self-check, then close public web, admin, and backup issues first.
Guideline 4.0 and the diagnosis sheet are on IPA’s site. Use those as the primary source.
Makoto Tejima can help review versions, admin exposure, and backup practice for public sites and business systems. Please contact us.